CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26042 – Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
https://notcve.org/view.php?id=CVE-2024-26042
18 Mar 2024 — This could result in arbitrary code execution in the context of the victim's browser. • https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26032 – Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
https://notcve.org/view.php?id=CVE-2024-26032
18 Mar 2024 — This could result in arbitrary code execution in the context of the victim's browser. • https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20761 – Adobe Animate 2024 BMP File Parsing Out-Of-Bound Write Remote Code execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-20761
18 Mar 2024 — Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/animate/apsb24-19.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20754 – Lightroom Desktop | Untrusted Search Path (CWE-426)
https://notcve.org/view.php?id=CVE-2024-20754
18 Mar 2024 — Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/lightroom/apsb24-17.html • CWE-426: Untrusted Search Path •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20755 – Adobe Bridge PDF Parsing Heap Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-20755
18 Mar 2024 — Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/bridge/apsb24-15.html • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20756 – Adobe Bridge 2024 Out of Bound Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-20756
18 Mar 2024 — Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/bridge/apsb24-15.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20746 – Adobe Premiere Pro Out-of-bounds Write Arbitrary code execution
https://notcve.org/view.php?id=CVE-2024-20746
18 Mar 2024 — Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28848 – SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
https://notcve.org/view.php?id=CVE-2024-28848
15 Mar 2024 — OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28847 – SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata
https://notcve.org/view.php?id=CVE-2024-28847
15 Mar 2024 — OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, `AlertUtil::validateExpression` is also called from `EventSubscriptionRepository.prepare()`, which can lead to Remote Code Execution. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that, even though there is an ... • https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28253 – SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
https://notcve.org/view.php?id=CVE-2024-28253
15 Mar 2024 — OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` g... • https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection • CWE-94: Improper Control of Generation of Code ('Code Injection') •